Privacy Policy

1. Controller

The controller in accordance with the General Data Protection Regulation (GDPR) is:

Christian-Liebig-Stiftung e.V.
Frundsbergstraße 23
80634 Munich, Germany
E-Mail:

No data protection officer has been appointed.

2. General Information on Data Processing

We process personal data of users of our website only to the extent necessary to provide a functional website and our content and services. The processing of personal data is usually carried out only with the consent of the data subject or if permitted by legal provisions.

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Further storage may occur if required by legal retention obligations.

3. Website Provision and Hosting

Our website is operated by an external hosting provider (DomainFactory GmbH). The hosting provider processes personal data exclusively within the scope of commissioned data processing in accordance with Art. 28 GDPR.

For each visit to the website, the hosting provider automatically collects information in so-called server log files, including:

• IP address (shortened/anonymized)
• Date and time of access
• Requested page or file
• Browser type and version
• Operating system used

This processing is carried out to ensure the technical security and stability of the website based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure provision of our online offering.

4. Integration of External Media

Our website may include content from external platforms (e.g., video or media providers). These contents are only loaded after the active consent of users. No personal data is transmitted to external services before consent is given.

• YouTube videos: These are only played after consent. No data is sent to YouTube or Google before the user actively agrees.

5. Contact via Email or Contact Form

When contacting us by email or through the contact form, the personal data you provide (e.g., name, email address, content of the message) is processed solely for the purpose of handling your request.

For spam and abuse protection, we use Friendly Captcha. Technical data such as IP address or browser information may be processed temporarily. More information is available directly from the provider: Friendly Captcha Privacy Policy.

Legal basis for processing is Art. 6(1)(a) (consent) and (f) GDPR (legitimate interest in preventing abuse/spam).

Data will be deleted as soon as it is no longer required for processing the request and no legal retention obligations apply.

6. Donations via the Donation Form

For donations, we use an external donation form from twingle GmbH, Prinzenallee 74, 13357 Berlin, embedded via iframe.

Personal data processed in this context includes:

• Personal identification data
• Address data
• Contact data
• Payment data

Processing occurs to identify donors, handle donations, and issue donation receipts.

Legal basis for processing is Art. 6(1)(a) and (b) GDPR. Data is stored according to statutory retention periods, typically up to 10 years.

Twingle processes data on behalf of the controller in accordance with Art. 28 GDPR. Storage takes place on servers in Germany.

Depending on the chosen payment method, data may be forwarded to external payment providers, particularly PayPal (PayPal Europe S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). In this case, the payment provider processes the data independently according to its privacy policy.

7. Sale of the Christian-Liebig-Stiftung Notebook

When purchasing the notebook, personal data is processed for order processing, delivery, communication, and fulfillment of legal obligations.

Processed data includes:

• Personal identification data
• Address and contact data
• Order and payment data

For spam and abuse protection, we use Friendly Captcha: Privacy Policy Friendly Captcha.

Legal basis is Art. 6(1)(b) GDPR. Data is stored according to statutory retention periods, usually up to 10 years after the last order.

Payment may be processed by external providers such as PayPal, which handle data independently in compliance with their privacy policies.

8. Processing of Member, Sponsor, and Donor Data (openhearts)

To manage members, sponsors, and donors, we use an external management system (openhearts).

Personal data processed includes names, addresses, contact data, bank details, and donation or sponsorship history.

Processing is carried out for member management, donation handling, communication, and fulfillment of legal obligations based on Art. 6(1)(b) and (c) GDPR.

Data processing by openhearts occurs under commissioned data processing according to Art. 28 GDPR.

No special categories of personal data are processed.

9. Newsletter

Our website offers the option to subscribe to a newsletter via CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

The so-called double opt-in procedure is used. After registration, you will receive an email asking you to confirm your subscription. Your email address is only added to the mailing list after confirmation.

Processed data includes:

• Email address
• Optional name
• Subscription and confirmation date/time
• Usage data (open and click rates)

Processing is based on Art. 6(1)(a) (consent) and (f) GDPR (legitimate interest, spam protection).

Newsletter sending occurs under commissioned data processing according to Art. 28 GDPR. A corresponding contract with CleverReach exists.

You can unsubscribe from the newsletter at any time via the link included in each email. Data will be deleted after unsubscribing, unless legal retention obligations exist.

10. Postal Mailings

Personal data may be processed for postal information and advertising purposes, including name and address data.

Legal basis is Art. 6(1)(a) or (f) GDPR. Our legitimate interest is direct marketing under Recital 47 GDPR.

Processing occurs only as long as required for the purpose or until withdrawal of consent.

11. Rights of Data Subjects

Data subjects have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

Requests to exercise these rights should be sent to the contact address above.

You also have the right to lodge a complaint with a competent data protection authority.

12. Changes to this Privacy Policy

We reserve the right to update this privacy policy if required due to legal or technical developments.